One thing I don't like about Android in general is how many permissions a lot of apps get. I can't tell what exactly they're using them for and whether that "full network access" means an app (with root access) can upload all my contacts or files to some remote server.

On Windows and Linux I always have a firewall (and anti-malware software) installed and set to manual/strict mode, so I know what app is trying to access what remote IP. Can't do that on Android, so I don't keep any information I wouldn't want to fall into wrong hands (no usernames, passwords, photos, etc.)...

Disabling root by default is very reasonable, especially for a ROM that is used by thousands of "normal users"...